Analysis
-
max time kernel
149s -
max time network
139s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
05-06-2024 12:08
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://internal.qualcomm.us.com/gqKeTta-bn9EGtXTTTTTA?/raffle/prizes/ZN3zOAKXoHHHHKi7fvGl
Resource
win10-20240404-en
General
-
Target
https://internal.qualcomm.us.com/gqKeTta-bn9EGtXTTTTTA?/raffle/prizes/ZN3zOAKXoHHHHKi7fvGl
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133620635836885093" chrome.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 4344 chrome.exe 4344 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3104 chrome.exe Token: SeCreatePagefilePrivilege 3104 chrome.exe Token: SeShutdownPrivilege 3104 chrome.exe Token: SeCreatePagefilePrivilege 3104 chrome.exe Token: SeShutdownPrivilege 3104 chrome.exe Token: SeCreatePagefilePrivilege 3104 chrome.exe Token: SeShutdownPrivilege 3104 chrome.exe Token: SeCreatePagefilePrivilege 3104 chrome.exe Token: SeShutdownPrivilege 3104 chrome.exe Token: SeCreatePagefilePrivilege 3104 chrome.exe Token: SeShutdownPrivilege 3104 chrome.exe Token: SeCreatePagefilePrivilege 3104 chrome.exe Token: SeShutdownPrivilege 3104 chrome.exe Token: SeCreatePagefilePrivilege 3104 chrome.exe Token: SeShutdownPrivilege 3104 chrome.exe Token: SeCreatePagefilePrivilege 3104 chrome.exe Token: SeShutdownPrivilege 3104 chrome.exe Token: SeCreatePagefilePrivilege 3104 chrome.exe Token: SeShutdownPrivilege 3104 chrome.exe Token: SeCreatePagefilePrivilege 3104 chrome.exe Token: SeShutdownPrivilege 3104 chrome.exe Token: SeCreatePagefilePrivilege 3104 chrome.exe Token: SeShutdownPrivilege 3104 chrome.exe Token: SeCreatePagefilePrivilege 3104 chrome.exe Token: SeShutdownPrivilege 3104 chrome.exe Token: SeCreatePagefilePrivilege 3104 chrome.exe Token: SeShutdownPrivilege 3104 chrome.exe Token: SeCreatePagefilePrivilege 3104 chrome.exe Token: SeShutdownPrivilege 3104 chrome.exe Token: SeCreatePagefilePrivilege 3104 chrome.exe Token: SeShutdownPrivilege 3104 chrome.exe Token: SeCreatePagefilePrivilege 3104 chrome.exe Token: SeShutdownPrivilege 3104 chrome.exe Token: SeCreatePagefilePrivilege 3104 chrome.exe Token: SeShutdownPrivilege 3104 chrome.exe Token: SeCreatePagefilePrivilege 3104 chrome.exe Token: SeShutdownPrivilege 3104 chrome.exe Token: SeCreatePagefilePrivilege 3104 chrome.exe Token: SeShutdownPrivilege 3104 chrome.exe Token: SeCreatePagefilePrivilege 3104 chrome.exe Token: SeShutdownPrivilege 3104 chrome.exe Token: SeCreatePagefilePrivilege 3104 chrome.exe Token: SeShutdownPrivilege 3104 chrome.exe Token: SeCreatePagefilePrivilege 3104 chrome.exe Token: SeShutdownPrivilege 3104 chrome.exe Token: SeCreatePagefilePrivilege 3104 chrome.exe Token: SeShutdownPrivilege 3104 chrome.exe Token: SeCreatePagefilePrivilege 3104 chrome.exe Token: SeShutdownPrivilege 3104 chrome.exe Token: SeCreatePagefilePrivilege 3104 chrome.exe Token: SeShutdownPrivilege 3104 chrome.exe Token: SeCreatePagefilePrivilege 3104 chrome.exe Token: SeShutdownPrivilege 3104 chrome.exe Token: SeCreatePagefilePrivilege 3104 chrome.exe Token: SeShutdownPrivilege 3104 chrome.exe Token: SeCreatePagefilePrivilege 3104 chrome.exe Token: SeShutdownPrivilege 3104 chrome.exe Token: SeCreatePagefilePrivilege 3104 chrome.exe Token: SeShutdownPrivilege 3104 chrome.exe Token: SeCreatePagefilePrivilege 3104 chrome.exe Token: SeShutdownPrivilege 3104 chrome.exe Token: SeCreatePagefilePrivilege 3104 chrome.exe Token: SeShutdownPrivilege 3104 chrome.exe Token: SeCreatePagefilePrivilege 3104 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe 3104 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3104 wrote to memory of 4128 3104 chrome.exe 73 PID 3104 wrote to memory of 4128 3104 chrome.exe 73 PID 3104 wrote to memory of 2748 3104 chrome.exe 75 PID 3104 wrote to memory of 2748 3104 chrome.exe 75 PID 3104 wrote to memory of 2748 3104 chrome.exe 75 PID 3104 wrote to memory of 2748 3104 chrome.exe 75 PID 3104 wrote to memory of 2748 3104 chrome.exe 75 PID 3104 wrote to memory of 2748 3104 chrome.exe 75 PID 3104 wrote to memory of 2748 3104 chrome.exe 75 PID 3104 wrote to memory of 2748 3104 chrome.exe 75 PID 3104 wrote to memory of 2748 3104 chrome.exe 75 PID 3104 wrote to memory of 2748 3104 chrome.exe 75 PID 3104 wrote to memory of 2748 3104 chrome.exe 75 PID 3104 wrote to memory of 2748 3104 chrome.exe 75 PID 3104 wrote to memory of 2748 3104 chrome.exe 75 PID 3104 wrote to memory of 2748 3104 chrome.exe 75 PID 3104 wrote to memory of 2748 3104 chrome.exe 75 PID 3104 wrote to memory of 2748 3104 chrome.exe 75 PID 3104 wrote to memory of 2748 3104 chrome.exe 75 PID 3104 wrote to memory of 2748 3104 chrome.exe 75 PID 3104 wrote to memory of 2748 3104 chrome.exe 75 PID 3104 wrote to memory of 2748 3104 chrome.exe 75 PID 3104 wrote to memory of 2748 3104 chrome.exe 75 PID 3104 wrote to memory of 2748 3104 chrome.exe 75 PID 3104 wrote to memory of 2748 3104 chrome.exe 75 PID 3104 wrote to memory of 2748 3104 chrome.exe 75 PID 3104 wrote to memory of 2748 3104 chrome.exe 75 PID 3104 wrote to memory of 2748 3104 chrome.exe 75 PID 3104 wrote to memory of 2748 3104 chrome.exe 75 PID 3104 wrote to memory of 2748 3104 chrome.exe 75 PID 3104 wrote to memory of 2748 3104 chrome.exe 75 PID 3104 wrote to memory of 2748 3104 chrome.exe 75 PID 3104 wrote to memory of 2748 3104 chrome.exe 75 PID 3104 wrote to memory of 2748 3104 chrome.exe 75 PID 3104 wrote to memory of 2748 3104 chrome.exe 75 PID 3104 wrote to memory of 2748 3104 chrome.exe 75 PID 3104 wrote to memory of 2748 3104 chrome.exe 75 PID 3104 wrote to memory of 2748 3104 chrome.exe 75 PID 3104 wrote to memory of 2748 3104 chrome.exe 75 PID 3104 wrote to memory of 2748 3104 chrome.exe 75 PID 3104 wrote to memory of 2060 3104 chrome.exe 76 PID 3104 wrote to memory of 2060 3104 chrome.exe 76 PID 3104 wrote to memory of 1396 3104 chrome.exe 77 PID 3104 wrote to memory of 1396 3104 chrome.exe 77 PID 3104 wrote to memory of 1396 3104 chrome.exe 77 PID 3104 wrote to memory of 1396 3104 chrome.exe 77 PID 3104 wrote to memory of 1396 3104 chrome.exe 77 PID 3104 wrote to memory of 1396 3104 chrome.exe 77 PID 3104 wrote to memory of 1396 3104 chrome.exe 77 PID 3104 wrote to memory of 1396 3104 chrome.exe 77 PID 3104 wrote to memory of 1396 3104 chrome.exe 77 PID 3104 wrote to memory of 1396 3104 chrome.exe 77 PID 3104 wrote to memory of 1396 3104 chrome.exe 77 PID 3104 wrote to memory of 1396 3104 chrome.exe 77 PID 3104 wrote to memory of 1396 3104 chrome.exe 77 PID 3104 wrote to memory of 1396 3104 chrome.exe 77 PID 3104 wrote to memory of 1396 3104 chrome.exe 77 PID 3104 wrote to memory of 1396 3104 chrome.exe 77 PID 3104 wrote to memory of 1396 3104 chrome.exe 77 PID 3104 wrote to memory of 1396 3104 chrome.exe 77 PID 3104 wrote to memory of 1396 3104 chrome.exe 77 PID 3104 wrote to memory of 1396 3104 chrome.exe 77 PID 3104 wrote to memory of 1396 3104 chrome.exe 77 PID 3104 wrote to memory of 1396 3104 chrome.exe 77
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://internal.qualcomm.us.com/gqKeTta-bn9EGtXTTTTTA?/raffle/prizes/ZN3zOAKXoHHHHKi7fvGl1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffecc329758,0x7ffecc329768,0x7ffecc3297782⤵PID:4128
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=228 --field-trial-handle=1800,i,5708137125032016616,12060322509716609090,131072 /prefetch:22⤵PID:2748
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1904 --field-trial-handle=1800,i,5708137125032016616,12060322509716609090,131072 /prefetch:82⤵PID:2060
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1668 --field-trial-handle=1800,i,5708137125032016616,12060322509716609090,131072 /prefetch:82⤵PID:1396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2840 --field-trial-handle=1800,i,5708137125032016616,12060322509716609090,131072 /prefetch:12⤵PID:2268
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2848 --field-trial-handle=1800,i,5708137125032016616,12060322509716609090,131072 /prefetch:12⤵PID:3100
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4520 --field-trial-handle=1800,i,5708137125032016616,12060322509716609090,131072 /prefetch:12⤵PID:4504
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4860 --field-trial-handle=1800,i,5708137125032016616,12060322509716609090,131072 /prefetch:82⤵PID:4248
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2880 --field-trial-handle=1800,i,5708137125032016616,12060322509716609090,131072 /prefetch:82⤵PID:1448
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3012 --field-trial-handle=1800,i,5708137125032016616,12060322509716609090,131072 /prefetch:82⤵PID:4760
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4900 --field-trial-handle=1800,i,5708137125032016616,12060322509716609090,131072 /prefetch:82⤵PID:4968
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2244 --field-trial-handle=1800,i,5708137125032016616,12060322509716609090,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4344
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:5012
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192B
MD57cd5acba812f7c63246eeeaaae3029df
SHA11b340fb3ec1de6d7ad56ad65d992df3065b11983
SHA256e36a14ffb86589ef58a562f04c1638f35975f18ebfe09efba7078ff52c475216
SHA512b98b77f15177b00ea9d4e16b92f620f772939067a4c3f94706eb6371bcd2b21c7e246141532ec30b0890d049be062e8d6a923b48652bb68763388ed504e7cc0a
-
Filesize
2KB
MD573ed96ed561d9b79498b2eb20894af38
SHA131e2d4ddf1cb0cb403db71cc6decf9a96e3b958b
SHA256203d69dff0c73d353c67d37c9436d1433851a38ef436f150525949c61bd97950
SHA512377b549d261990ea05eb827de981615f757425f0e66ab2eaf7880eaeeaf0a7d5b8f5f8adfc4ff6d459fc9e9e7d784d8ab6fb6fa99e1f750e9cc42b000dfb1db7
-
Filesize
1KB
MD5d14c213e9c7bd389aa56d3137f1111e7
SHA1e61ead69f368a031bbef802daa0e722289fe740e
SHA256431775bc0abee27e1ef68ef4a7eabf518559a6c1a2d6cdb5aaeb08c88a36c5ec
SHA51294f32a1a3738ff1621e3cbfee003ae80b54c30a1d54aa01d528bbe4f03bfda2016a45dc2142021e21e3e2b0ca890c98da304a06e4704760d861156c0623b6f24
-
Filesize
6KB
MD534172d96ff012903e135a3dba922a67b
SHA1e827a34280c0364e4f70f8e48333935846aa8f42
SHA256969184ae82c8813d64bcbdbf4374859257da70932700ae7d37206a730cc389ed
SHA512f8ce0312a867a1d7ebf75bc4b237811504ae5eae8b63b938987edb71ae413f02e35402c16be5c541ca8b5f05030cc47de9be6fae2ede542b310a7228a2c898f6
-
Filesize
138KB
MD5932a36ff97925c1089ba9b4adf20352f
SHA1b809b69d3204824364deec6af91f68e383ebe1fd
SHA256262cf0285a1243cbfc0f4f9e0965e60d17f2cc1cf65e8bf31d43f0e9c51bae31
SHA512d7e4938b4ff39479afe43d20125641426ea97abb401c0f479b303adf236f5a7bde7604a6e41da5f9da50272940da824d9af883abd60321c96f03af7e94a6eb82
-
Filesize
157KB
MD5eefc56736f22bbf09300b78323855eda
SHA112e6056da72b2443f624707362a3661eabcdb853
SHA25687f21069c0586bde50268b6acab3055a83d8e18b702be2a524d185695795b2c5
SHA5128d78411ebcd0d13cecdf67a673bcdddb85bdffec778ac22ff093b14c90c511cda61a69530e50451aeae48ad11dd34bd7e9333e02717d5e740a6c3f7696b4166d
-
Filesize
138KB
MD589a7795f6c94a038fbd2845174e3c64a
SHA1d2765065c18775b0a000ea4e5ffcd96f78967ead
SHA256292487f4fcf44b1400fc0ba48ff47fec29a2d9b69e4ecf9ad822bc50ce7eba6b
SHA5128d9a1829d0b57f1998b5664035ac699c6e8b40d3478d7148828f11d2a957527108ee78424babc091fb8aaeec969c29c596f2c41eaa988566f657657e051c42ca
-
Filesize
137KB
MD53485219d67cf92fc0ec6bc51d7218c86
SHA131238935f959879d42a4d755a78aceb110c88c43
SHA256be795a7bbdf21106b8bd96af1a520ab1a1615dfe52ec5b1097dab37fe460d4ff
SHA512bb123b76b882dcd44cf715c54a184bccce2a699126ab93eeef5c6850ed051bf00ce9776694cc865bacf4b44ad3953ca4c4a2b08cbdef0ab67013e2dd44c24fad
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd